Spokane Public Schools network security incident

Analyst assessment

DysruptionHub assesses with high confidence that Spokane Public Schools is responding to a confirmed cyber-related security incident. According to NonStop Local KHQ, the district told families it was investigating a “network security incident” and had taken several systems offline as a precaution. The district’s security-specific wording is concrete public cyber evidence, although it does not establish the attack mechanism, malicious actor or scope of compromise.

The district’s notice updated Oct. 26 says an unauthorized party first gained network access Sept. 9 and accessed and copied certain files approximately Sept. 17–20. SPS identified suspicious activity Sept. 20 and engaged outside cybersecurity specialists. These later findings establish an earlier intrusion window and confirmed file copying; the initial access technique and specific personal information remain under review.

Operational significance

The district warned that families could encounter service disruptions when asking teachers or staff for information. KXLY reported Sept. 22 that PowerSchool was among the affected programs; students and parents found it inaccessible or not updating, and teachers used manual processes for work they would ordinarily perform in PowerSchool. Superintendent Adam Swinyard said the district quarantined critical systems that include payroll and student information while a third-party technical expert investigated. The Spokesman-Review reported Sept. 22 that the district’s payroll system, as well as PowerSchool, was offline. The report does not establish that scheduled payroll payments failed, that PowerSchool’s own systems were compromised or a vendor-wide PowerSchool compromise. Later findings about possible district student and staff data compromise are discussed below.

The available evidence does not establish that schools closed, instruction stopped, transportation was disrupted or emergency and safety functions were unavailable.

The Spokesman-Review reported Sept. 24 that PowerSchool and BusinessPlus, the district’s payroll system, remained offline. Teachers continued recording attendance manually. The district did not anticipate missing payday; concern about pay is not a documented missed payment. PowerSchool said its investigation found no affected hosted product or data belonging to other customers, bounding the disruption to this district rather than a vendor-wide incident.

Current status

KREM reported Sept. 25 that the district had begun restoring access. In a Sept. 28 update reported by KXLY, Spokane Public Schools said attendance and grading systems were back online for staff. It expected the Parent and Student Portals to become accessible Wednesday, Sept. 30, after staff entered information from the outage period. The outside investigation continued, and the district said it would contact people if it determined they were affected. On Sept. 30, KXLY reported that parents and students could again access PowerSchool for grades and attendance. The district warned that some data might take several days to synchronize. It said outside specialists were still determining the incident’s scope, had no timeline for completing the forensic investigation and would notify families if it found their information affected. The portal restoration is confirmed, but synchronization and the investigation remained ongoing Sept. 30; a complete recovery date is not established.

The district’s application status dashboard previously carried an Oct. 6 notice that PowerSchool SIS, PowerTeacher Pro and enrollment services may be intermittently unavailable while staff investigate a districtwide connectivity problem. An older Oct. 1 notice says some district applications are offline or do not recognize staff logins. Several tools are online but may contain stale data. The dashboard’s automated Oct. 15 timestamps do not establish a new incident or independently date the cause of each application problem. The explicit Oct. 6 connectivity notice documents a later partial-service limitation, rather than complete restoration.

When checked Oct. 30, the dashboard instead displayed a maintenance message without individual application status. That change does not establish full recovery or explain whether any remaining application limitations relate to the incident.

Confidence and uncertainty

Confidence is high that the district experienced a security incident and imposed a precautionary systems shutdown because local reporting directly quoted district messages and Superintendent Swinyard. KXLY’s reporting establishes that PowerSchool was affected and manual workarounds continued Sept. 22. The district publishes system-by-system application status, but has not released final forensic findings.

The district’s earlier staff-only preliminary assessment was superseded by an Oct. 8 update. KXLY reported that Spokane Public Schools now had reason to believe student and staff data was compromised. Outside cybersecurity specialists and district IT personnel were identifying the specific information affected; the district said it would contact impacted individuals once details were verified. It provided no estimated completion date for the investigation.

The Oct. 26 district notice supersedes the earlier uncertainty about copying: an unauthorized party accessed and copied certain files. The district is still identifying the specific personal information and affected individuals. It says it does not maintain students’ or parents’ Social Security numbers, so those numbers were not affected; that assurance does not extend to every staff data category. SPS says it has notified law enforcement and will provide further information on identity protection and individual notification as its review progresses. KXLY’s Oct. 9 follow-up provided general expert advice rather than new forensic findings. Ransomware involvement, extortion and threat-actor attribution remain unresolved.

A NightSpire listing on Ransomware.live names a masked victim, “Spo**** Schools.” The name pattern and timing make Spokane Public Schools a possible match, but the listing supplies no website, full victim name, attack date or corroborating details. We assess the link to this district with low confidence. The listing does not establish that NightSpire was involved in the district’s incident, that ransomware was deployed or that data was stolen.

SOCRadar’s Oct. 12 report names the district as an alleged NightSpire victim and describes about 25 exposed credentials associated with its domain, including 10 employee authentication records. The report does not provide the original threat-actor post or establish that the credentials enabled this incident. These vendor findings do not independently confirm the masked listing’s identity, NightSpire’s responsibility, ransomware deployment or data theft.

Analytic gaps

The public record does not identify the initial access vector, vulnerability, compromised account or device, malware family, affected network segments, persistence, encryption, ransom demand, threat actor or the third-party investigator. File copying and law-enforcement notification are now confirmed by the district; copied-file contents and scale remain unresolved. It does not establish which individual records or people may have been affected, or whether scheduled payroll payments, transportation, food service, special education, health records, telephones or email were disrupted. The complete restoration timeline remains unknown. The dashboard’s Oct. 6 connectivity warning is a dated partial-service observation. Automated timestamps do not establish the cause of every later application limitation.

Operational disruption is assessed as presumed resolved as of Nov. 2. Targeted official and public-source checks found no newer specific material restriction, alongside the documented recovery signals. A complete restoration date remains unconfirmed; ongoing investigation and data notifications are separate.